{"action":"created","comment":{"url":"https://api.github.com/repos/python/cpython/pulls/comments/123497792","pull_request_review_id":45705702,"id":123497792,"diff_hunk":"@@ -744,6 +744,16 @@ getenvironment(PyObject* environment)\n                 \"environment can only contain strings\");\n             goto error;\n         }\n+        if (PyUnicode_FindChar(key, '\\0', 0, PyUnicode_GET_LENGTH(key), 1) != -1 ||\n+            PyUnicode_FindChar(value, '\\0', 0, PyUnicode_GET_LENGTH(value), 1) != -1)\n+        {\n+            PyErr_SetString(PyExc_ValueError, \"embedded null character\");\n+            goto error;\n+        }\n+        if (PyUnicode_FindChar(key, '=', 0, PyUnicode_GET_LENGTH(key), 1) != -1) {","path":"Modules/_winapi.c","position":null,"original_position":10,"commit_id":"b92de1154ece0b1d8fcf6b6a03bc1a3f908dd1af","original_commit_id":"5c9d5764b19faac9e9b5858461de3a7209f82d80","user":{"login":"eryksun","id":958268,"avatar_url":"https://avatars1.githubusercontent.com/u/958268?v=3","gravatar_id":"","url":"https://api.github.com/users/eryksun","html_url":"https://github.com/eryksun","followers_url":"https://api.github.com/users/eryksun/followers","following_url":"https://api.github.com/users/eryksun/following{/other_user}","gists_url":"https://api.github.com/users/eryksun/gists{/gist_id}","starred_url":"https://api.github.com/users/eryksun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eryksun/subscriptions","organizations_url":"https://api.github.com/users/eryksun/orgs","repos_url":"https://api.github.com/users/eryksun/repos","events_url":"https://api.github.com/users/eryksun/events{/privacy}","received_events_url":"https://api.github.com/users/eryksun/received_events","type":"User","site_admin":false},"body":"As far as I know you won't find anything helpful on MSDN. Their article on changing environment variables says that equals cannot be used in the name, without explaining its use as the first character. Also, their article on changing the current directory incorrectly states that `SetCurrentDirectory` remembers per-drive directories, which it definitely never does. \r\n\r\nThe Windows API consumes these variables when resolving paths, but it never sets them. That's left to applications, and usually via the C runtime `chdir` function. Since Python has its own implementation of `chdir` on Windows, you can see how it sets these variables in [`win32_wchdir`](https://github.com/python/cpython/blob/a3d91b43c2851312fb942f31afa12f5961706db6/Modules/posixmodule.c#L1498).","created_at":"2017-06-22T12:37:41Z","updated_at":"2017-06-22T12:37:41Z","html_url":"https://github.com/python/cpython/pull/2325#discussion_r123497792","pull_request_url":"https://api.github.com/repos/python/cpython/pulls/2325","_links":{"self":{"href":"https://api.github.com/repos/python/cpython/pulls/comments/123497792"},"html":{"href":"https://github.com/python/cpython/pull/2325#discussion_r123497792"},"pull_request":{"href":"https://api.github.com/repos/python/cpython/pulls/2325"}}},"pull_request":{"url":"https://api.github.com/repos/python/cpython/pulls/2325","id":126932683,"html_url":"https://github.com/python/cpython/pull/2325","diff_url":"https://github.com/python/cpython/pull/2325.diff","patch_url":"https://github.com/python/cpython/pull/2325.patch","issue_url":"https://api.github.com/repos/python/cpython/issues/2325","number":2325,"state":"open","locked":false,"title":"bpo-30730: Prevent environment variables injection in subprocess on Windows.","user":{"login":"serhiy-storchaka","id":3659035,"avatar_url":"https://avatars0.githubusercontent.com/u/3659035?v=3","gravatar_id":"","url":"https://api.github.com/users/serhiy-storchaka","html_url":"https://github.com/serhiy-storchaka","followers_url":"https://api.github.com/users/serhiy-storchaka/followers","following_url":"https://api.github.com/users/serhiy-storchaka/following{/other_user}","gists_url":"https://api.github.com/users/serhiy-storchaka/gists{/gist_id}","starred_url":"https://api.github.com/users/serhiy-storchaka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/serhiy-storchaka/subscriptions","organizations_url":"https://api.github.com/users/serhiy-storchaka/orgs","repos_url":"https://api.github.com/users/serhiy-storchaka/repos","events_url":"https://api.github.com/users/serhiy-storchaka/events{/privacy}","received_events_url":"https://api.github.com/users/serhiy-storchaka/received_events","type":"User","site_admin":false},"body":"Prevent passing other environment variables and command arguments.","created_at":"2017-06-22T08:12:02Z","updated_at":"2017-06-22T12:37:41Z","closed_at":null,"merged_at":null,"merge_commit_sha":"6f67423bc7c130838dedf866bae433d9b60b06b5","assignee":null,"assignees":[],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/python/cpython/pulls/2325/commits","review_comments_url":"https://api.github.com/repos/python/cpython/pulls/2325/comments","review_comment_url":"https://api.github.com/repos/python/cpython/pulls/comments{/number}","comments_url":"https://api.github.com/repos/python/cpython/issues/2325/comments","statuses_url":"https://api.github.com/repos/python/cpython/statuses/b92de1154ece0b1d8fcf6b6a03bc1a3f908dd1af","head":{"label":"serhiy-storchaka:env-var-injection","ref":"env-var-injection","sha":"b92de1154ece0b1d8fcf6b6a03bc1a3f908dd1af","user":{"login":"serhiy-storchaka","id":3659035,"avatar_url":"https://avatars0.githubusercontent.com/u/3659035?v=3","gravatar_id":"","url":"https://api.github.com/users/serhiy-storchaka","html_url":"https://github.com/serhiy-storchaka","followers_url":"https://api.github.com/users/serhiy-storchaka/followers","following_url":"https://api.github.com/users/serhiy-storchaka/following{/other_user}","gists_url":"https://api.github.com/users/serhiy-storchaka/gists{/gist_id}","starred_url":"https://api.github.com/users/serhiy-storchaka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/serhiy-storchaka/subscriptions","organizations_url":"https://api.github.com/users/serhiy-storchaka/orgs","repos_url":"https://api.github.com/users/serhiy-storchaka/repos","events_url":"https://api.github.com/users/serhiy-storchaka/events{/privacy}","received_events_url":"https://api.github.com/users/serhiy-storchaka/received_events","type":"User","site_admin":false},"repo":{"id":81707316,"name":"cpython","full_name":"serhiy-storchaka/cpython","owner":{"login":"serhiy-storchaka","id":3659035,"avatar_url":"https://avatars0.githubusercontent.com/u/3659035?v=3","gravatar_id":"","url":"https://api.github.com/users/serhiy-storchaka","html_url":"https://github.com/serhiy-storchaka","followers_url":"https://api.github.com/users/serhiy-storchaka/followers","following_url":"https://api.github.com/users/serhiy-storchaka/following{/other_user}","gists_url":"https://api.github.com/users/serhiy-storchaka/gists{/gist_id}","starred_url":"https://api.github.com/users/serhiy-storchaka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/serhiy-storchaka/subscriptions","organizations_url":"https://api.github.com/users/serhiy-storchaka/orgs","repos_url":"https://api.github.com/users/serhiy-storchaka/repos","events_url":"https://api.github.com/users/serhiy-storchaka/events{/privacy}","received_events_url":"https://api.github.com/users/serhiy-storchaka/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/serhiy-storchaka/cpython","description":"The Python programming language","fork":true,"url":"https://api.github.com/repos/serhiy-storchaka/cpython","forks_url":"https://api.github.com/repos/serhiy-storchaka/cpython/forks","keys_url":"https://api.github.com/repos/serhiy-storchaka/cpython/keys{/key_id}","collaborators_url":"https://api.github.com/repos/serhiy-storchaka/cpython/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/serhiy-storchaka/cpython/teams","hooks_url":"https://api.github.com/repos/serhiy-storchaka/cpython/hooks","issue_events_url":"https://api.github.com/repos/serhiy-storchaka/cpython/issues/events{/number}","events_url":"https://api.github.com/repos/serhiy-storchaka/cpython/events","assignees_url":"https://api.github.com/repos/serhiy-storchaka/cpython/assignees{/user}","branches_url":"https://api.github.com/repos/serhiy-storchaka/cpython/branches{/branch}","tags_url":"https://api.github.com/repos/serhiy-storchaka/cpython/tags","blobs_url":"https://api.github.com/repos/serhiy-storchaka/cpython/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/serhiy-storchaka/cpython/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/serhiy-storchaka/cpython/git/refs{/sha}","trees_url":"https://api.github.com/repos/serhiy-storchaka/cpython/git/trees{/sha}","statuses_url":"https://api.github.com/repos/serhiy-storchaka/cpython/statuses/{sha}","languages_url":"https://api.github.com/repos/serhiy-storchaka/cpython/languages","stargazers_url":"https://api.github.com/repos/serhiy-storchaka/cpython/stargazers","contributors_url":"https://api.github.com/repos/serhiy-storchaka/cpython/contributors","subscribers_url":"https://api.github.com/repos/serhiy-storchaka/cpython/subscribers","subscription_url":"https://api.github.com/repos/serhiy-storchaka/cpython/subscription","commits_url":"https://api.github.com/repos/serhiy-storchaka/cpython/commits{/sha}","git_commits_url":"https://api.github.com/repos/serhiy-storchaka/cpython/git/commits{/sha}","comments_url":"https://api.github.com/repos/serhiy-storchaka/cpython/comments{/number}","issue_comment_url":"https://api.github.com/repos/serhiy-storchaka/cpython/issues/comments{/number}","contents_url":"https://api.github.com/repos/serhiy-storchaka/cpython/contents/{+path}","compare_url":"https://api.github.com/repos/serhiy-storchaka/cpython/compare/{base}...{head}","merges_url":"https://api.github.com/repos/serhiy-storchaka/cpython/merges","archive_url":"https://api.github.com/repos/serhiy-storchaka/cpython/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/serhiy-storchaka/cpython/downloads","issues_url":"https://api.github.com/repos/serhiy-storchaka/cpython/issues{/number}","pulls_url":"https://api.github.com/repos/serhiy-storchaka/cpython/pulls{/number}","milestones_url":"https://api.github.com/repos/serhiy-storchaka/cpython/milestones{/number}","notifications_url":"https://api.github.com/repos/serhiy-storchaka/cpython/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/serhiy-storchaka/cpython/labels{/name}","releases_url":"https://api.github.com/repos/serhiy-storchaka/cpython/releases{/id}","deployments_url":"https://api.github.com/repos/serhiy-storchaka/cpython/deployments","created_at":"2017-02-12T06:21:03Z","updated_at":"2017-02-12T06:21:24Z","pushed_at":"2017-06-22T12:18:41Z","git_url":"git://github.com/serhiy-storchaka/cpython.git","ssh_url":"git@github.com:serhiy-storchaka/cpython.git","clone_url":"https://github.com/serhiy-storchaka/cpython.git","svn_url":"https://github.com/serhiy-storchaka/cpython","homepage":"https://www.python.org/","size":208282,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"python:master","ref":"master","sha":"a3d91b43c2851312fb942f31afa12f5961706db6","user":{"login":"python","id":1525981,"avatar_url":"https://avatars0.githubusercontent.com/u/1525981?v=3","gravatar_id":"","url":"https://api.github.com/users/python","html_url":"https://github.com/python","followers_url":"https://api.github.com/users/python/followers","following_url":"https://api.github.com/users/python/following{/other_user}","gists_url":"https://api.github.com/users/python/gists{/gist_id}","starred_url":"https://api.github.com/users/python/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/python/subscriptions","organizations_url":"https://api.github.com/users/python/orgs","repos_url":"https://api.github.com/users/python/repos","events_url":"https://api.github.com/users/python/events{/privacy}","received_events_url":"https://api.github.com/users/python/received_events","type":"Organization","site_admin":false},"repo":{"id":81598961,"name":"cpython","full_name":"python/cpython","owner":{"login":"python","id":1525981,"avatar_url":"https://avatars0.githubusercontent.com/u/1525981?v=3","gravatar_id":"","url":"https://api.github.com/users/python","html_url":"https://github.com/python","followers_url":"https://api.github.com/users/python/followers","following_url":"https://api.github.com/users/python/following{/other_user}","gists_url":"https://api.github.com/users/python/gists{/gist_id}","starred_url":"https://api.github.com/users/python/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/python/subscriptions","organizations_url":"https://api.github.com/users/python/orgs","repos_url":"https://api.github.com/users/python/repos","events_url":"https://api.github.com/users/python/events{/privacy}","received_events_url":"https://api.github.com/users/python/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/python/cpython","description":"The Python programming language","fork":false,"url":"https://api.github.com/repos/python/cpython","forks_url":"https://api.github.com/repos/python/cpython/forks","keys_url":"https://api.github.com/repos/python/cpython/keys{/key_id}","collaborators_url":"https://api.github.com/repos/python/cpython/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/python/cpython/teams","hooks_url":"https://api.github.com/repos/python/cpython/hooks","issue_events_url":"https://api.github.com/repos/python/cpython/issues/events{/number}","events_url":"https://api.github.com/repos/python/cpython/events","assignees_url":"https://api.github.com/repos/python/cpython/assignees{/user}","branches_url":"https://api.github.com/repos/python/cpython/branches{/branch}","tags_url":"https://api.github.com/repos/python/cpython/tags","blobs_url":"https://api.github.com/repos/python/cpython/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/python/cpython/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/python/cpython/git/refs{/sha}","trees_url":"https://api.github.com/repos/python/cpython/git/trees{/sha}","statuses_url":"https://api.github.com/repos/python/cpython/statuses/{sha}","languages_url":"https://api.github.com/repos/python/cpython/languages","stargazers_url":"https://api.github.com/repos/python/cpython/stargazers","contributors_url":"https://api.github.com/repos/python/cpython/contributors","subscribers_url":"https://api.github.com/repos/python/cpython/subscribers","subscription_url":"https://api.github.com/repos/python/cpython/subscription","commits_url":"https://api.github.com/repos/python/cpython/commits{/sha}","git_commits_url":"https://api.github.com/repos/python/cpython/git/commits{/sha}","comments_url":"https://api.github.com/repos/python/cpython/comments{/number}","issue_comment_url":"https://api.github.com/repos/python/cpython/issues/comments{/number}","contents_url":"https://api.github.com/repos/python/cpython/contents/{+path}","compare_url":"https://api.github.com/repos/python/cpython/compare/{base}...{head}","merges_url":"https://api.github.com/repos/python/cpython/merges","archive_url":"https://api.github.com/repos/python/cpython/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/python/cpython/downloads","issues_url":"https://api.github.com/repos/python/cpython/issues{/number}","pulls_url":"https://api.github.com/repos/python/cpython/pulls{/number}","milestones_url":"https://api.github.com/repos/python/cpython/milestones{/number}","notifications_url":"https://api.github.com/repos/python/cpython/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/python/cpython/labels{/name}","releases_url":"https://api.github.com/repos/python/cpython/releases{/id}","deployments_url":"https://api.github.com/repos/python/cpython/deployments","created_at":"2017-02-10T19:23:51Z","updated_at":"2017-06-22T12:33:31Z","pushed_at":"2017-06-22T12:18:43Z","git_url":"git://github.com/python/cpython.git","ssh_url":"git@github.com:python/cpython.git","clone_url":"https://github.com/python/cpython.git","svn_url":"https://github.com/python/cpython","homepage":"https://www.python.org/","size":207873,"stargazers_count":8341,"watchers_count":8341,"language":"Python","has_issues":false,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1556,"mirror_url":null,"open_issues_count":324,"forks":1556,"open_issues":324,"watchers":8341,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/python/cpython/pulls/2325"},"html":{"href":"https://github.com/python/cpython/pull/2325"},"issue":{"href":"https://api.github.com/repos/python/cpython/issues/2325"},"comments":{"href":"https://api.github.com/repos/python/cpython/issues/2325/comments"},"review_comments":{"href":"https://api.github.com/repos/python/cpython/pulls/2325/comments"},"review_comment":{"href":"https://api.github.com/repos/python/cpython/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/python/cpython/pulls/2325/commits"},"statuses":{"href":"https://api.github.com/repos/python/cpython/statuses/b92de1154ece0b1d8fcf6b6a03bc1a3f908dd1af"}}}}
{"actor":{"display_login":"eryksun"}}